Meta Warns of FreeType Vulnerability (CVE-2025-27363) With Active Exploitation Risk

Mar 13, 2025Ravie LakshmananOpen Source / Vulnerability

Meta has warned that a security vulnerability impacting the FreeType open-source font rendering library may have been exploited in the wild.

The vulnerability has been assigned the CVE identifier CVE-2025-27363, and carries a CVSS score of 8.1, indicating high severity. Described as an out-of-bounds write flaw, it could be exploited to achieve remote code execution when parsing certain font files.

“An out-of-bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files,” the company said in an advisory.

“The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution.”

The company did not share any specifics on how the shortcoming is being exploited, who is behind it, and the scale of the attacks. However, it acknowledged that the bug “may have been exploited in the wild.”

When reached for comment, FreeType developer Werner Lemberg told The Hacker News that a fix for the vulnerability has been incorporated for almost two years. “FreeType versions larger than 2.13.0 are no longer affected,” Lemberg said.

In a separate message posted on the Open Source Security mailing list oss-security, it has come to light that several Linux distributions are running an outdated version of the library, thus rendering them susceptible to the flaw. This includes –

• AlmaLinux
• Alpine Linux
• Amazon Linux 2
• Debian stable / Devuan
• RHEL / CentOS Stream / Alma Linux / etc. 8 and 9
• GNU Guix
• Mageia
• OpenMandriva
• openSUSE Leap
• Slackware, and
• Ubuntu 22.04

In light of active exploitation, users are recommended to update their instances to the latest version of FreeType (2.13.3) for optimal protection.

Upgrade your audio game with the Logitech for Creators Blue Yeti USB Microphone. With over 33,730 ratings and an impressive 4.6 out of 5 stars, it’s no wonder this is an Amazon’s Choice product. Recently, 5K+ units were purchased in the past month.

Available in five stunning colors: Teal, Silver, Pink Dawn, Midnight Blue, and Blackout, this microphone is perfect for creators looking to produce exceptional audio. Priced at only $84.99, it’s a deal you can’t afford to miss.

Elevate your recordings with clear broadcast-quality sound and explore your creativity with enhanced effects, advanced modulation, and HD audio samples. Order now for just $84.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!